• Home
  • Linux
  • Docker
  • Windows
    • PS
    • C#
    • Exchange Server
  • Other
    • Perl
    • IPV6
    • MacOS
  • DB
    • MSSQL
    • MariaDB
    • PG

Home

How to clean out golden tickets after a succesful attack on your active directory

Details
Written by: po3dno
Category: Power Shell
Created: 10 July 2019
Hits: 1363

If an attack made it into your active directory‍ environment and got a golden ticket‍, there is a specific set of steps you need to take to make sure you've cleaned out the adversary:

  1. Disconnect the affected networks. Entirely.
  2. Remediate any persistence mechanisms left behind
  3. Reset passwords of ALL high privileged access accounts
  4. Reset passwords of all VPN access credentials (+other remote access you may have)
  5. Change the krbtgt‍ hash using https://gallery.technet.microsoft.com/Reset-the-krbtgt-account-581a9e51 run in it the order of using first option 1, then option 2 and then option 3: (https://cdn-images-1.medium.com/max/1000/1*Gk48jksjPuThTrPnJNHW-w.png)
  6. Wait minimum 10 hours
  7. Change the krbtgt hash again using https://gallery.technet.microsoft.com/Reset-the-krbtgt-account-581a9e51 run in it the order of using first option 1, then option 2 and then option 3: (https://cdn-images-1.medium.com/max/1000/1*Gk48jksjPuThTrPnJNHW-w.png)

CONFIGURING OTHER MACHINES OR MULTIPLE BOOT LOADERS FROM .VHDXs

Details
Written by: po3dno
Category: Other
Created: 08 July 2019
Hits: 1254

If you copy the “MASTER .VHDX”, you could re-use it for multiple boots, even for other machines.

Here’s the procedure once you have an existing MASTER .VHDX already created.

First, copy and rename the .VHDX to a different name depending on what you will install, like “Windows_10_for_Testing_Betas.VHDX” or whatever. In my screenshots I’m still using a similar name than before, though.

1. Check initial boot loaders

You can configure the boot options of windows by using the command-line tool bcdedit.exe.

bcdedit /v

Let’s say you start in another computer with a single boot from a single regular partition, you’ll see a similar description to the following:

image

You can see that I currently just have a single boot loader, booting from the C: partition.

2 What we want to do is to create a second BOOT LOADER by copying the current Windows Boot Loader. Type:

bcdedit /copy {current} /d “Windows 10 .VHDX Boot”

That line means you are copying the current Boot loader (the one I marked) but naming it with a different DESCRIPTION. And also, very important, when you copy any BOOT LOADER, the new copy will have a new GUID identifier, which is what you are going to use.

Then, type again bcdedit /v to see the new BOOT LOADER created:

image

You can see how now you have a second BOOT LOADER (#2 BOOT) with a different GUID than the original (#1 BOOT).

It also has the new description applied like “Windows 10 .VHDX Boot”. You’ll see that description when selecting the Boot option when starting your machine.

However ,you are still not done, as that second BOOT LOADER is still pointing to the C:\ partition, and you want it to be pointing to the .VHDX file!

 

3 Copy the new GUID (from BOOT #2) with the mouse, so you can use it in the next step. In this case I copy: {bd67a0a4-a586-11e6-bf4e-bc8385086e7d}

 

4 In order to point BOOT LOADER #2 to your .VHDX file, type the following 2 commands:

bcdedit /set {My_new_GUID_Number} device vhd=[C:]\VHDs\Windows10_Enterprise_x64_Bootable.vhdx

bcdedit /set {My_new_GUID_Number} osdevice vhd=[C:]\VHDs\Windows10_Enterprise_x64_Bootable.vhdx 

Note the difference in “device” and “osdevice”..

image

Now, you are done with the “hard” configuration.

Check that you have this new boot from Computer properties –> Advanced System Settings –> Advaced –>Startup and Recvovery –>Settings button:

image

 

You can just reboot the machine and select the BOOT option for your new .VHDX, and it’ll boot natively from that .VHDX!

 

Other BCDEDIT configurations:

You can update your boot loaders with commands like the following using the GUID of the BOOT LOADER you want to change:

TO CHANGE THE DESCRIPTION

bcdedit /set {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx} description “Windows 7 .VHD Image”

COPY

bcdedit /copy {Original_GUID_Number} /d “my new description”
or
bcdedit /copy {current} /d “my new description”
or
bcdedit /copy {default} /d “my new description”

Backup all database without replica

Details
Written by: po3dno
Category: MSSQL
Created: 24 June 2019
Hits: 1195

DECLARE @name VARCHAR(50) -- database name
DECLARE @path VARCHAR(256) -- path for backup files
DECLARE @fileName VARCHAR(256) -- filename for backup
DECLARE @fileDate VARCHAR(20) -- used for file name

-- specify database backup directory
SET @path = 'D:\Backup\'

-- specify filename format
SELECT @fileDate = CONVERT(VARCHAR(20),GETDATE(),112)

DECLARE db_cursor CURSOR READ_ONLY FOR
SELECT name
FROM master.sys.databases
WHERE name NOT IN ('master','model','msdb','tempdb') -- exclude these databases
AND state = 0 -- database is online
AND is_in_standby = 0 -- database is not read only for log shipping
AND replica_id is NULL --without replica

OPEN db_cursor
FETCH NEXT FROM db_cursor INTO @name

WHILE @@FETCH_STATUS = 0
BEGIN
SET @fileName = @path + @name + '_' + @fileDate + '.BAK'
BACKUP DATABASE @name TO DISK = @fileName

FETCH NEXT FROM db_cursor INTO @name
END


CLOSE db_cursor
DEALLOCATE db_cursor

Поиск данных

Details
Written by: po3dno
Category: MSSQL
Created: 04 June 2019
Hits: 1200
DECLARE
   @SearchText varchar(200),
   @Table varchar(100),
   @TableID int,
   @ColumnName varchar(100),
   @String varchar(1000);
--modify the variable, specify the text to search for
SET @SearchText = 'John';
DECLARE CursorSearch CURSOR
    FOR SELECT name, object_id
        FROM sys.objects
      WHERE type = 'U';
--list of tables in the current database. Type = 'U' = tables(user-defined)
OPEN CursorSearch;
FETCH NEXT FROM CursorSearch INTO @Table, @TableID;
WHILE
       @@FETCH_STATUS
       =
       0
    BEGIN
        DECLARE CursorColumns CURSOR
            FOR SELECT name
                  FROM sys.columns
                WHERE
                       object_id
                       =
                       @TableID AND system_type_id IN(167, 175, 231, 239);
        -- the columns that can contain textual data        
--167 = varchar; 175 = char; 231 = nvarchar; 239 = nchar        
OPEN CursorColumns;
        FETCH NEXT FROM CursorColumns INTO @ColumnName;
        WHILE
               @@FETCH_STATUS
               =
               0
            BEGIN
                SET @String = 'IF EXISTS (SELECT * FROM '
                            + @Table
                            + ' WHERE '
                            + @ColumnName
                            + ' LIKE ''%'
                            + @SearchText
                            + '%'') PRINT '''
                            + @Table
                            + ', '
                            + @ColumnName
                            + '''';
                EXECUTE (@String);
                FETCH NEXT FROM CursorColumns INTO @ColumnName;
            END;
        CLOSE CursorColumns;
        DEALLOCATE CursorColumns;
        FETCH NEXT FROM CursorSearch INTO @Table, @TableID;
    END;
CLOSE CursorSearch;
DEALLOCATE CursorSearch;

linux commands

Details
Written by: po3dno
Category: Other
Created: 08 May 2019
Hits: 1071

Архивы

Создать архив .tar/.tar.gz

tar -cvf file.tar /full/path — создать .tar (без сжатия)

tar -czvf file.tar.gz /full/path — создать .tar.gz (архив GZip)

Распаковать архив .tar/.tar.gz

tar -xvf file.tar — распаковать обычный .tar (без сжатия)

tar -xzvf file.tar.gz — распаковать .tar.gz (запакованны GZip-ом)

Распаковать архив .gz (GZip, без TAR)

gunzip file.gz — распаковать обычный .gz (GZip, без TAR. Распаковываемый архив должен иметь права на исполнение: chmod +x file.gz)

 

Базы данных MySQL

Импорт дампа базы данных

mysql -u db_user -p -h localhost db_name < dump.sql

Импорт дампа базы данных, упакованных в gzip (*.sql.gz)

gunzip < dump.sql.gz | mysql -u db_user -p db_name

Экспорт базы данных (создание дампа)

mysqldump -u db_user -p -h localhost db_name > dump.sql

Создание архива GZip с дампом БД

mysqldump -u db_user -p -h localhost db_name | gzip > dump.tar.gz

Создание дампа нескольких баз данных одновременно

mysqldump -u db_user -p -h localhost -B db_name1 db_name2 db_name3 > databases.sql

Создание дампа всех баз данных

mysqldump -u db_user -p -h localhost -A > all-databases.sql

Сохранить только структуру БД

mysqldump —no-data -u db_user -p -h localhost db_name > schema.sql

Создание дампа только одной или нескольких таблиц БД

mysqldump -u db_user -p -h localhost db_name tbl_name1 tbl_name2 tbl_name3 > dump.sql

Дополнительные атрибуты (уменьшают размер дампа и повышают скорость работы)

mysqldump -Q -c -e -u db_user -p -h localhost db_name > /path/to/file/dump.sql

— Q — оборачивает имена обратными кавычками;

— c — делает полную вставку, включая имена колонок;

— e — делает расширенную вставку.

Если не запускается MySQL, лог ошибок можно увидеть прямо в консоли (команда для Windows)

mysqld —defaults-file=C:Program Files…my.ini —console

 

Файлы/директории

Узнать абсолютный путь до текущего каталога

pwd

Удалить папку со всем ее содержимым

rm -R /path/to/dir

Создать символьную ссылку

ln -s  /etc/apache2/sites-available/site.com.conf /etc/apache2/sites-enabled/site.com.conf

Подсчитать количество файлов в текущем каталоге (включая вложенные)

find . -type f | wc -l

Подсчитать занимаемый размер каталога

du -sh /var

Вывести на экран количество файлов в поддиректориях текущего каталога

for D in `ls -Fl | grep / | awk ‘{print $9}’` ; do echo $D `find -L $D -type f -print | wc -l` ; done

Удалить в директории все файлы старше N дней

find /home/user -type f -mtime +N -exec rm {} ;

Узнать информацию об использовании inodes (файловых дескрипторов):

df -i

Создать патч

diff -uN file.orig file.new > file.patch

Наложить патч

patch file.orig < file.patch

Найти определенные файлы и скопировать их с сохранением иерархии

find . -name «ru.po» -exec cp —parents «{}» /destination/dir/ «;»

 

Прочее

Вывести последние 10 строк из лог-файла, с автообновлением в реальном времени

tail -n10 -f /var/log/sites/your-site.ru.error.log

(путь до файлов с логами Apache у вас скорее всего будет другим)

Узнать информацию о процессоре

cat /proc/cpuinfo

или

lscpu

Показать ТОП10 медленных запросов MySQL (сортировка по времени исполнения time):

mysqldumpslow -s t -t 10 /var/log/mysql-slow.log

Показать ТОП10 запросов MySQL, в который не используются индексы (сортировка по кол-ву вызовов count):

mysqldumpslow -s c -t 10 /var/log/mysql-slow.log

Установить корректно конвертер шрифтов (Debian):

apt-get install libssl-dev build-essential zlibc zlib-bin libidn11-dev libidn11

wget http://people.mozilla.com/~jkew/woff/woff-code-latest.zip

unzip woff-code-latest.zip -d sfnt2woff && cd sfnt2woff && make && mv sfnt2woff /usr/local/bin/

  1. AddNewDBsToGroup
  2. чтение DNS лога
  3. mount vhd
  4. SQL AG config multisubnets

Subcategories

Power Shell Article Count:  53

C# Article Count:  10

Perl Article Count:  1

Exchange Server Article Count:  15

Other Article Count:  24

MSSQL Article Count:  17

Windows Article Count:  26

MariaDB Article Count:  3

Linux Article Count:  9

Docker Article Count:  3

pg Article Count:  2

Page 15 of 32

  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19

Login Form

  • Forgot your password?
  • Forgot your username?

Statistics

  • Users 2
  • Articles 178
  • Articles View Hits 176331